Automatic dashboard group sharing for the newly created customer

Who it’s for

Tenant administrators running multi-customer ThingsBoard PE deployments who want every new customer to automatically get access to a shared dashboard group — without manually sharing it after each customer signs up. Useful for SaaS-style tenants where all customers should see the same set of “public” dashboards as soon as their account exists.

What it does

A new customer is created; its “All” users group automatically gains read-only access to the shared dashboard group. Extends the default Root Rule chain with the dashboard-sharing flow on the Entity Created path:

• Is it a customer? filters incoming Entity Created messages down to CUSTOMER originators only — everything else (assets, devices, other entity types) is dropped here.
• Fetch URL-related attributes enriches the message with two tenant attributes — requestUrl and sharedDashboardGroupId — into metadata, so the flow doesn’t hardcode your instance’s host or the target group.
• Check URL attributes in metadata presence verifies both attributes are actually set before continuing. If either is missing, the message is dropped here instead of firing an API call with an incomplete URL.
• Prepare API request body builds the JSON body the shareEntityGroup endpoint expects: the new customer as ownerId, allUserGroup: true (its own “All” users group), and readElseWrite: true (read-only access).
• Share dashboard group with customer sends the request to {requestUrl}/api/entityGroup/{sharedDashboardGroupId}/share, authenticating with an API Key pulled from Secrets Storage.

Result: the moment a new customer is created, its “All” users group is automatically granted read-only access to the dashboard group you configure — including sub-customers (owned by another customer), since the share targets the newly created customer itself regardless of where it sits in the customer hierarchy.

Requirements

• An entity group (typically of type DASHBOARD) that already exists and that you want every new customer to see.
• Two tenant attributes the flow reads at runtime — set these before the chain will do anything:
  • requestUrl — the externally reachable base URL of your ThingsBoard instance (e.g. https://mytenant.example.com). If you’ve set a Base URL under white-labeling, use that value.
  • sharedDashboardGroupId — the id of the entity group to auto-share.
• A Secrets Storage secret named shareApiKey (type TEXT) holding a valid, non-revoked Personal Access Token (API Key) for a Tenant Admin.

How to set up

This chain reacts to Customer lifecycle events, which are never routed through a device or asset profile’s default rule chain — so there’s only one correct way to install it.

1. Click Install to open the install dialog. Leave Set as profile default rule chain off and choose Install only — customers have no profile, so binding to one would never receive these events.
2. Make the installed chain your tenant’s root rule chain, or — if you want to keep your existing root — extract the dashboard-sharing flow (the 5 nodes described above) into a nested rule chain and connect it to the Entity Created output of Message Type Switch in your current root. Either way, this chain already bundles the default processing (saving telemetry/attributes, RPC handling), so setting it as root doesn’t break the rest of your tenant’s message flow.
3. Set the requestUrl and sharedDashboardGroupId tenant attributes. The simplest way is a REST API call — POST /api/plugins/telemetry/TENANT/{tenantId}/SERVER_SCOPE with {"requestUrl": "...", "sharedDashboardGroupId": "..."}. You can also set them with a temporary chain — a generator rule node (originator set to Current Tenant) producing a POST_ATTRIBUTES_REQUEST message into a save-attributes node — or from the Update Multiple Attributes dashboard widget.
4. Create the shareApiKey secret in Secrets Storage with a valid API Key — see the Requirements section above for the access it needs.
5. Trigger the chain to validate it: create a new Customer in the UI, or via the Customer REST API. If everything is wired correctly, the new customer’s “All” users group is granted a read-only role on the target group within seconds — check Customer groups → the target dashboard group → Group permissions to confirm the role was added.

How to customize

• To share a different entity group, or point at a different host — update the sharedDashboardGroupId / requestUrl tenant attributes; no node edit needed, since both are attribute-driven.
• To grant write instead of read-only access — set readElseWrite to false in the Prepare API request body node’s script.
• To share with a specific user group instead of every user of the new customer — set allUserGroup: false and userGroupId to the target user group’s id in the Prepare API request body node’s script.
• To limit which customers get auto-shared — add a filter node after Is it a customer? (e.g. checking a customer attribute or title pattern) instead of matching every CUSTOMER creation event.